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1 . This opinion contains indications relating to the following items: 

Basis of the opinion 
Priority 

Non-establishment of opinion with regard to novelty, inventive step and industrial applicability 
Lack of unity of invention 

Reasoned statement under Rule 436/S.1 (a)(i) with regard to novelty, inventive step or industrial 
applicability; citations and explanations supporting such statement 

Certain documents cited 

Certain defects in the international application 
Certain observations on the international application 

2. FURTHER ACTION 

If a demand for international preliminary examination is made, this opinion will usually be considered to be a 
written opinion of the International Preliminary Examining Authority ("I PEA"). However, this does not apply where 
the applicant chooses an Authority other than this one to be the I PEA and the chosen IPEA has notifed the 
International Bureau under Rule 66.1o/s(b) that written opinions of this International Searching Authority 
will not be so considered. 

If this opinion is, as provided above, considered to be a written opinion of the IPEA, the applicant is invited to 
submit to the IPEA a written reply together, where appropriate, with amendments, before the expiration of three 
months from the date of mailing of Form PCT/ISA/220 or before the expiration of 22 months from the priority date, 
whichever expires later. 

For further options, see Form PCT/ISA£20. 

3. For further details, see notes to Form PCT/ISA£20. 
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Box No. 1 Basis of the opinion 



1 . With regard to the language, this opinion has been established on the basis of the international application in 
the language in which it was filed, unless otherwise indicated under this item. 



□ This opinion has been established on the basis of a translation from the original language into the following 
language , which is the language of a translation furnished for the purposes of international search 
(under Rules 12.3 and 23.1(b)). 

2. With regard to any nucleotide and/or amino acid sequence disclosed in the international application and 
necessary to the claimed invention, this opinion has been established on the basis of: 

a. type of material: 

□ a sequence listing 

□ table(s) related to the sequence listing 

b. format of material: 

□ in written format 

□ in computer readable form 

c. time of filingyfurnishing: 

□ contained in the international application as filed. 

□ filed together with the international application in computer readable form. 

□ furnished subsequently to this Authority for the purposes of search. 

3. □ In addition, in the case that more than one version or copy of a sequence listing anclbr table relating theretc 

has been filed or furnished, the required statements that the information in the subsequent or additional 
copies is identical to that in the application as filed or does not go beyond the application as filed, as 
appropriate, were furnished. 

4. Additional comments: 
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Box No. V Reasoned statement under Rule 43Ws.1(a)(i) with regard to novelty, inventive step or 
industrial applicability; citations and explanations supporting such statement 

1. Statement 



Novelty (N) 


Yes: 


Claims 


1-23 




No: 


Claims 




Inventive step (IS) 


Yes. 


Claims 






No: 


Claims 


1-23 


Industrial applicability (IA) 


Yes: 


Claims 


1-23 




No: 


Claims 





2. Citations and explanations 
see separate sheet 
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Re Item V. 

1 Reference is made to the following document: 

D1 : COPPENS J ET AL: 11 A Scaleable Monitoring Platform for the Internet 

(SCAMPI). Deliverable 2.3: Enhanced SCAMPI Implementation and 

Applications", April 2004. 
D2 : WO 03/094418 A, 13 November 2003 



2 The present application does not meet the criteria of Article 33(1 ) PCT, because the 
subject-matter of claim 1 does not involve an inventive step in the sense of Article 
33(3) PCT. 

Document D1 is regarded as being the closest prior art to the subject-matter of claim 
1 , and discloses (the references in parentheses applying to this document) a method 
of processing data, this method comprising: 
receiving data from a network link; 

replicating said data to produce at least two editions of the received data (page 
49, lines 24-31); 

writing said editions of the received data to an area of memory in a host (figure 
4.5 "sockets rings") that is directly accessible by a host application (figure 4.5: 
applications A -Z use "mmapO" for accessing the editions of the received data). 

The subject-matter of claim 1 therefore differs from this known method in that the 
replication of data is performed onboard a network analyser card. 

This feature provides an alternative solution to the problem of efficient monitoring of 
network traffic, and has the advantage of not requiring host processing capacity for 
the replication of the packets (as stated in the description, page 5, last paragraph). 

Even though in D1 the duplication of packets is performed by the network adapter 
driver (see page 49 or page 76), D1 already suggests the implementation of kernel 
functionality (e.g. driver) in the network adapted card to off-load the host processor 
(see D1 page 9, lines 4-10 and page 52, section 4.6, first paragraph). It would 
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therefore be obvious to the person skilled in the art, to apply this feature (i.e. 
replicating the data onboard the network analysis card) with the corresponding effect 
to a method according D1 thus arriving at a method of processing data according to 
claim 1 . 



3 Furthermore, D1 discloses a network analyser card for connection to a host 
comprising a description adder configured and arranged to add a descriptor to 
substantially each of the data frames of each of the at least two replica editions of the 
received data frames, the descriptor including data about the data frame to which it is 
attached for use in processing the data frame (see sections 7.2.4 and 7.2.8). 
Therefore, taking into account the point 2 above, the subject-matter of claim 14 does 
not involve an inventive step in the sense of Article 33(3) PCT. 

4 The subject-matter of claim 20 differs from that of claim 1 in that the host comprises 
at least two processors for processing the editions of received data. Even though this 
feature is not explicitly disclosed in D1 , the use of multiprocessor hosts is a matter of 
customary practice in the field of traffic monitoring (see e.g. D2, page 2, line 23 - 
page 3, line 9). Therefore, the subject-matter of claim 20 does not involve an 
inventive step in the sense of Article 33(3) PCT. 

5 Furthermore, the subject-matter of claim 23 does not involve an inventive step in the 
sense of Article 33(3) PCT. 

Document D1 already anticipates an intrusion detection system comprising a host 
according to claim 20 (see point 4 above) wherein the processors are arranged to 
execute rules of an intrusion detection system on data packets received by the host 
(see D1 , page 94, line 19 - page 95, line 18). 

6 Dependent claims 2-1 3, 1 5-1 9, 21 , 22 do not contain any features which, in 
combination with the features of any claim to which they refer, meet the requirements 
of the PCT in respect of inventive step (Article 33(3) PCT). 
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